How to update SSL certs

[dustinbird]

I have been requested to update the SSL certificates on my 3 servers running the docker containers for OpenVas. I was advised that the certificates are stored in the container. How do I locate these and replace them?

[immauss]

well ... that depends.

How did you setup the SSL certs initially? Are they the self signed certs generated by the container ?

-Scott

[dustinbird]

That is a good question. I will check with Gareth in my IT team as he said he sent a document to you about this and that I should be able to find it here somewhere but I am unable at present.

[immauss]

You can alwasy set the location via GSA_ARGS.

-e GSA_ARGS="--ssl-private-key=<file location> --ssl-certificate=<file location> "

Also documented here:
GSA_ARGS

[dustinbird]

is there a way to see the location of the current ones?

[immauss]

If you are using something other than the self signed, it should show in how you are starting the container. Either through a volume or bind mappping or a docker cp ?
But they should be in ...

/data/var-lib/gvm/private/CA

I've always used:
https://github.com/immauss/rev-prox

-Scott

[immauss]

@dustinbird
Any luck?

[dustinbird]

Hi Scott, Sorry I was on annual leave last week and didn’t get any further with this. The issue I am facing is the certs I have do not match the names of anything that I can see in the docker containers on any of the servers. I am still attempting to get hold of Gareth to see if he is able to throw some light on this. I assume once I locate this then it is just a case of updating the existing files with the new, is this a copy process or would I need to run a script to update the cert and other elements too? Dustin Bird Deployment Co-ordinator IQX Limited The Steading Office | Newhouse | MELROSE | TD6 9JT T: 01835 340 062 E: ***@***.*** ***@***.***>* W: https://www.iqx.co.uk IQX is a registered trademark of IQX Limited. IQX Limited is registered in Scotland SC171786 Registered Office: The Steading Office, Newhouse, Lilliesleaf, Melrose TD6 9JT

…

________________________________________________________ This message is intended solely for the designated recipient, may contain privileged or confidential information and may be subject to confidentiality agreement(s). Access to this email by anyone else is unauthorised. If you are not the intended recipient any reliance, disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. If you have received this message in error, please notify the sender immediately by reply e-mail and destroy the original communication. Opinions and views expressed in this e-mail are those of the sender. They may not reflect the opinions and views of the company, and shall be understood as being neither given nor endorsed by it.

________________________________________________________ *From:* GE Scott Knauss ***@***.***> *Sent:* 10 February 2025 01:25 *To:* immauss/openvas ***@***.***> *Cc:* Dustin Bird ***@***.***>; Mention ***@***.***> *Subject:* Re: [immauss/openvas] How to update SSL certs (Issue #327) @dustinbird <https://github.com/dustinbird> Any luck? — Reply to this email directly, view it on GitHub <#327 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AQNV6M6MRB3AAVWIE3S2DPD2O7PU5AVCNFSM6AAAAABWCOXLM2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMNBWGY2TCMJTGQ> . You are receiving this because you were mentioned.Message ID: < ***@***.***>

[immauss]

Answers to those questions all depend on how it is setup now. :(
Sorry ...

[gareth-johnstone]

@dustinbird Looking back at my previous open issue regarding this matter #28 (comment)

It appears the locations we use are

/data/var-lib/gvm/private/CA - Private key Location
/data/var-lib/gvm/CA - Certificate Location

However, I think the approach of using the GSA_ARGS would be much preferred

[dustinbird]

Thanks @gareth-johnstone if this is the best option for us I will go with this.